CVE-2024-6796 Vulnerability in Baxter Connex Health Portal
Unauthenticated attackers can access and modify the Connex Health Portal database due to improper access control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-6796?
CVE-2024-6796 is a high-severity missing authorization vulnerability in Baxter Connex Health Portal, published on 9 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Baxter Connex health portal released before 8/30/2024, an improper access control vulnerability has been found that could allow an unauthenticated attacker to gain unauthorized access to Connex portal's database and/or modify content.
Weakness: CWE-284
Which versions are affected by CVE-2024-6796?
It affects 1 product.
Products include Baxter Connex Health Portal.
How do I fix CVE-2024-6796?
No fix has been published for CVE-2024-6796 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-6796 being exploited?
There is no known exploitation of CVE-2024-6796 in the wild and no public exploit code.
Other vulnerabilities in Baxter Connex Health Portal
Sources
Also known as GHSA-q77r-qvf6-47wr.